9api -> auth: validateCredentials()
10auth -> db: SELECT user WHERE email = ?
11db -> auth: user row
12auth -> auth: verify password hash
13auth -> api: {valid: true, userId: "usr_01"}
13auth -> api: '{valid: true, userId: usr_01}'
14api -> api: generate JWT
15api -> client: 200 {token: "eyJ..."}
15api -> client: '200 {token: eyJ...}'
16
17client -> api: GET /profile (Bearer token)
18api -> auth: verifyToken()
19auth -> api: {userId: "usr_01"}
19auth -> api: '{userId: usr_01}'
20api -> db: SELECT * FROM users WHERE id = ?
21db -> api: user profile
22api -> client: 200 {name: "Alice", email: "..."}
22api -> client: '200 {name: Alice, email: ...}'
23
24client -> api: POST /logout (Bearer token)
25api -> auth: revokeToken()
26auth -> api: {revoked: true}